konami573-hardware

name: konami573-hardware description: "Konami System 573 arcade hardware: differences from PS1, register map (flash ROM, RTC, ATAPI, DIP switches, watchdog), JVS interface, I/O board variants (analog, digital, fishing, gun, DDR). Use when working with System 573 arcade hardware."

Konami System 573

The System 573 is a PlayStation-based system used in a number of Konami arcade games from the late 90s and early 2000s, most notably Dance Dance Revolution and other titles from the Bemani series of rhythm games.

• Differences vs. PS1
• Register map
• JVS interface
• I/O boards
• Security cartridges
• External modules
• BIOS
• Bootleg mod boards
• Game-specific information
• Notes
• Pinouts
• Credits, sources and links

This document is currently work-in-progress. Here is an incomplete list of things the authors believe need more research:

• The BIOS and games are notoriously picky about ATAPI drives due to Konami's libraries not always respecting timings and polling registers in the way suggested by the specifications. Such issues shall be documented more in detail.
• The GE765-PWB(B)A and PWB0000073070 I/O boards have been fully and partially reverse engineered respectively, but documentation for them is missing.
• The GN845-PWB(B) DDR stage PCB's communication protocol is largely unknown. More tests need to be done on real hardware and its CPLD shall be dumped if possible.
• The protocol used by the 573 to communicate with the PWB0000100991 network PCB has been reversed, however very little about the PCB's own hardware and software stack is otherwise known.
• Some revisions of the main board have two resistor footprints next to the Konami ASIC, one labeled FJ and the other SH. Only one of them is populated; it presumably sets or clears a bit in one of the ASIC input ports. Given the labels it may be related to the manufacturer of the onboard flash memory (Fujitsu or Sharp), however even boards fitted with Sharp chips come with the FJ resistor populated. Moreover, all known games identify the chips by probing their JEDEC ID.

Differences vs. PS1

Main changes

• Main RAM is 4 MB instead of 2 MB and VRAM is 2 MB instead of 1 MB. SPU RAM is still 512 KB.
• The CD-ROM drive is completely different. While the PS1's drive is fully integrated into the motherboard and uses a custom protocol, the 573 employs a standard ATAPI drive. It can thus boot from burned CD-Rs or even CD-RWs just fine (as long as the drive itself is capable of reading them in the first place), with no modifications needed to the stock hardware. There is no provision for playing XA-ADPCM, however CD-DA playback through the drive's own audio output (fed into the 573 motherboard via a 4-pin audio cable) is supported and used by some games.
• The SIO0 bus for controllers and memory cards is unused. It is broken out to a connector, however no known I/O board uses it. Some games supported PS1 controllers and memory cards through an adapter connected over JVS (see the external modules section).
• The "parallel I/O" expansion port is replaced by 2 PCMCIA slots. These slots are wired in parallel and mapped at the same address as the internal flash through bank switching. They are fairly limited though as they only support 16-bit bus accesses (i.e. /CE1 and /CE2 are tied together, even though the CPU actually exposes them as separate signals!), have no DMA and don't expose the PCMCIA I/O and configuration space (/IORD and /IOWR are not connected at all). This makes them incompatible with CF cards and most PCMCIA devices.

Additional hardware

• Audio and video outputs: unlike the PS1, which outputs composite, S-video and RGB, the 573 only outputs RGB with C-sync through the JAMMA connector and a DB15 port compliant with the JVS specification (same pinout as VGA but not directly compatible, as VGA normally runs at higher resolutions and uses separate H/V sync pins). A built-in 15 watt stereo speaker amplifier is also provided for cabinets that lack their own sound system.
• JAMMA interface and built-in I/O ports: the 573 provides multiple digital and analog ports for interfacing with arcade cabinet controls. Depending on the I/O board the system came with, these signals might be broken out through connectors on the system's case.
• Internal 16 MB flash memory: the 573's BIOS is capable of booting either from the CD drive or from an array of flash memory chips soldered to the motherboard, which are also memory mapped. Most Konami games are designed to run from flash: when attempting to run them from CD without also having them installed, the executable on the disc will erase the flash and install the game before starting. Most games still require the CD, in some cases a different one, to be kept in the drive after installation as they use it for music playback or to stream additional data.
• PCMCIA memory card: some games shipped with additional flash memory in the form of one or more 16 or 32 MB PCMCIA cards. Note that these are "linear" memory mapped flash cards without any built-in controller, not CF or ATA-compatible cards. See the BIOS section for more details on why CF cards are not supported.
• RTC and battery-backed 8 KB RAM: used by games to store settings, save data and installation info (possibly including serial numbers). Unfortunately the RTC chip is one of those all-in-one things with a battery sealed inside, soldered directly to the motherboard.
• JVS host: allows connection of multiple daisy chained peripherals using the standardized JVS protocol, based on a serial (RS-485) bus. The JVS port on the 573 was only ever "officially" used for the PS1 memory card reader module, however some games seem to support JVS I/O boards and input devices in addition to the built-in JAMMA connector.
• Security cartridge: optionally installed on the 573's side, contains a password protected EEPROM that holds factory pre-programmed data as well as keys generated during game installation, plus in some case a 64-bit serial number ROM. Security cartridges were bundled with most game discs as a way to prevent copying, as the discs themselves had no other protection of any kind. The CPU's serial port (SIO1) is also wired to the security cartridge slot.

Register map

All standard PS1 registers, with the exception of the CD-ROM drive's, are present and accessible. System 573-specific hardware is mapped into the EXP1 region at 0x1f000000. IRQ10 and DMA5, normally reserved for the expansion bus (and lightguns) on a regular PS1, are used to access the ATAPI drive, while IRQ2 and DMA3 go unused.

NOTE: EXP1 must be configured prior to accessing any of these registers. The configuration value written by Konami's code to the EXP1 delay/size register at 0x1f801008 is 0x24173f47. Afterwards, all bus writes shall be 16 or 32 bits wide. The behavior of 8-bit writes is undefined, but 8-bit reads work as intended.

Konami ASIC registers

Registers in the 0x1f400000-0x1f40000f region are handled by the Konami 056879 I/O ASIC, consisting of a single 8-bit output port and at least six 16-bit input ports. The same chip was used in other Konami arcade boards of the time.

0x1f400000 (ASIC register 0): ADC / Coin counters / Audio control

The ADC chip is an ADC0834 from TI, which uses a proprietary SPI-like protocol. Its four inputs are wired to the ANALOG connector on the 573 motherboard. Refer to the ADC083x datasheet for details on how to bitbang the protocol.

Mechanical coin counters are incremented by games whenever a coin is inserted by setting bit 3 or 4 for a fraction of a second and then clearing them. Bit 5 controls whether the onboard audio amp is enabled but does not affect the RCA line level outputs, which are always enabled. Setting bit 5 has no effect immediately as the amplifier takes about a second to turn on.

Bit 6 is used by games to mute audio from the CD-ROM drive or digital I/O board. However, testing on real hardware seems to suggest it is actually some sort of attenuation control, as the audio is still audible (albeit at a very low volume) when the bit is cleared. Note that some games, such as GuitarFreaks, break the CD/MP3 output to separate jacks on the front I/O panel rather than routing it through the motherboard, making bit 6 meaningless.

Bit 8 resets the JVS MCU. Since the reset pin is active-low, resetting is done by writing 0, waiting at least 10 H8 clock cycles (the BIOS waits 2 hblanks) and writing 1 again. Resetting the MCU will clear JVSDRDY but not JVSIRDY. As the 056879 ASIC's output register is only 8 bits wide, bit 8 is actually handled by a discrete flip-flop on the motherboard.

Unknown what reading from this port does.

0x1f400004 (ASIC register 2): DIP switches / JVS status / Security cartridge

The MCU status code can be one of the following values:

The MCU error code can be one of the following values:

Once an error is reported, the MCU will enter an endless loop and become unresponsive. In order to clear the error the MCU must be reset using bit 8 in register 0x1f400000.

The highest 8 bits read from this register are the current state of the security cartridge's I0-I7 pins. See the security cartridge section for an explanation of what each bit is wired to. Unknown whether reading from this register will clear the IRDY flag, if previously set by the cartridge.

Bit 3 (DIP switch 4) is used by the BIOS to determine whether to boot from flash. If set, the BIOS will attempt to search for a valid executable on the internal flash and both PCMCIA cards prior to falling back to the CD-ROM.

0x1f400006 (ASIC register 3): Misc. inputs

See the security cartridge section for more details about IRDY and DRDY. In order for bit 2 to be valid, IO0 should be set as an input by clearing the respective bit in register 0x1f500000.

0x1f400008 (ASIC register 4): JAMMA controls

As buttons are active-low (wired between JAMMA pins and ground), all bits are 0 when a button is pressed and 1 otherwise. The BIOS and games often read from this register and discard the result as a way of (inefficiently) flush the CPU's write queue.

0x1f40000a (ASIC register 5): Data from JVS MCU

This register is only valid when the JVSIRDY flag is set. After reading, a dummy write to 0x1f520000 shall be issued to clear JVSIRDY. If the MCU has more data available, it will update the register and set the flag again.

0x1f40000c (ASIC register 6): JAMMA controls / External inputs

As buttons are active-low (wired between JAMMA pins and ground), all bits are 0 when a button is pressed and 1 otherwise.

The signals for buttons 4 and 5 are wired in parallel to both JAMMA and the EXT-IN connector, while button 6 can only be connected through EXT-IN and is usually unused.

0x1f40000e (ASIC register 7): JAMMA controls / External inputs

As buttons are active-low (wired between JAMMA pins and ground), all bits are 0 when a button is pressed and 1 otherwise.

The signals for buttons 4 and 5 are wired in parallel to both JAMMA and the EXT-IN connector, while button 6 can only be connected through EXT-IN and is usually unused.

Bit 10 is probed by the 700B01 BIOS kernel to determine how to configure the main RAM controller. If cleared, the configuration register at 0x1f801060 is set to 0x4788, otherwise it is set to 0x0c80. This check was introduced alongside revision D of the main board, which features alternate footprints for two 2 MB chips in place of eight 512 KB ones.

IDE registers

The IDE interface consists of a 16-bit parallel data bus with a 3-bit address bus and two bank select pins (/CS0 and /CS1), giving a total of sixteen 16-bit registers of which only nine are typically used. On the 573 the two IDE banks are mapped to two separate memory regions at 0x1f480000 and 0x1f4c0000 respectively. The IDE interrupt pin is routed into IRQ10 through the CPLD, while all other signals on the 40-pin connector (DMA handshaking lines, status pins, etc.) go unused.

Most 573 games, with the exception of those that run entirely from the internal flash or PCMCIA cards, expect an ATAPI CD-ROM drive to be always connected and configured as the primary (master) drive. Connecting an additional ATA hard drive, CF card, IDE-to-SATA bridge or other device configured as secondary will not interfere with the BIOS or games, thus homebrew games and apps can leverage such a drive to store data separately from the currently installed game.

Note that IDE and ATAPI give slightly different meanings to each register. Refer to the ATA and ATAPI specifications for more details.

0x1f480000 (IDE bank 0, address 0): Data

Data transfers can also be performed through DMA. See below for details.

0x1f480002 (IDE bank 0, address 1): Error / Features

When read:

When written:

0x1f480004 (IDE bank 0, address 2): Sector count

In ATA 48-bit LBA mode, bits 8-15 of the number of sectors to transfer must be written to this register first, followed by bits 0-7.

In ATA CHS or 28-bit LBA mode, setting this register to 0 will cause 256 sectors to be transferred.

0x1f480006 (IDE bank 0, address 3): Sector number

In ATA 48-bit LBA mode, bits 24-31 of the target LBA must be written to this register first, followed by bits 0-7.

0x1f480008 (IDE bank 0, address 4): Cylinder number low

In ATA 48-bit LBA mode, bits 32-39 of the target LBA must be written to this register first, followed by bits 8-15.

When reset, ATAPI drives will set this register to 0x14.

0x1f48000a (IDE bank 0, address 5): Cylinder number high

In ATA 48-bit LBA mode, bits 40-47 of the target LBA must be written to this register first, followed by bits 16-23.

When reset, ATAPI drives will set this register to 0xeb.

0x1f48000c (IDE bank 0, address 6): Head number / Drive select

Bits 0-3 are not used in ATA 48-bit LBA mode.

0x1f48000e (IDE bank 0, address 7): Status / Command

When read:

When written:

In order to issue a command, the features, sector, cylinder and head registers must be set up appropriately before writing the command ID to this register. Refer to the ATA specification for a list of available commands and their parameters.

DRDY is set by the drive when it is ready to execute an ATA command. Note that ATAPI drives will not set DRDY initially, while still accepting ATAPI commands, in order to prevent misdetection as a hard drive. Before sending any command, a polling loop shall be used to wait until BSY is cleared.

DRQ is set when the drive is waiting for data to be read or written. Depending on the drive and command, an interrupt may also be fired when DRQ goes high after a command is issued. ERR/CHK is set if the last command executed resulted in an error; in that case the error register will contain more information about the cause of the error.

Reading from this register will acknowledge any pending drive interrupt and deassert IRQ10. Note that, as with all PS1 interrupts, IRQ10 must additionally be acknowledged at the interrupt controller side in order for it to fire again.

0x1f4c000c (IDE bank 1, address 6): Alternate status

Read-only mirror of the status register at 0x1f48000e that returns the same flags, but does not acknowledge any pending IRQ when read.

IDE DMA and quirks

DMA channel 5, normally reserved for the expansion port on a PS1, can be used to transfer data to/from the IDE bus... with some caveats. The "correct" way to connect an IDE drive to the PS1's DMA controller would to be to wire up DMARQ and /DMACK from the drive directly to the respective pins on the CPU, allowing the DMA controller to synchronize transfers to the drive's internal buffer in chunked mode.

However, Konami being Konami, they did not do this on the 573. IDE drives will instead interpret DMA reads or writes as a burst of regular ("PIO", as defined in the ATA specification) CPU-issued reads or writes. As such, the drive shall be configured for PIO data transfers rather than DMA using the "set features" ATA command, and bits 9-10 in the DMA5_CHCR register shall be cleared to put the channel in manual synchronization mode. The DRQ bit in the status register must also be polled manually prior to starting a transfer, to ensure the drive is ready for it.

RTC registers

The RTC is an ST M48T58. This chip behaves like an 8 KB 8-bit static RAM, wired to the lower 8 bits of the 16-bit data bus. It must thus be accessed by performing 16-bit bus accesses and ignoring/masking out the upper 8 bits (as with IDE control registers).

The first 8184 bytes are mapped to the 0x1f620000-0x1f623fef region and are simply battery-backed SRAM, which will retain its contents across power cycles as long as the RTC's battery is not dead. The last 8 bytes are used as clock and control registers.

The values of the clock registers are buffered: they are stored in intermediate registers rather than being read from or written to the clock counters directly. Bits 6 and 7 in the control register at 0x1f623ff0 are used to control transfers between the registers and clock counters. All clock values are returned in BCD format.

0x1f623ff0 (M48T58 register 0x1ff8): Calibration / Control

The values of all buffered clock registers are updated automatically. Setting bit 6 will disable this behavior while keeping the counters running, allowing for the registers to be read reliably without the RTC updating them at the same time. The bit shall be cleared after reading the registers.

Setting bit 7 will also halt buffered register updates, so that they can be overwritten manually with new values. Clearing it afterwards will result in the registers' values being copied back to the clock counters.

0x1f623ff2 (M48T58 register 0x1ff9): Seconds / Stop

0x1f623ff4 (M48T58 register 0x1ffa): Minute

0x1f623ff6 (M48T58 register 0x1ffb): Hour

Hours are always returned in 24-hour format, as there is no way to switch to 12-hour format.

0x1f623ff8 (M48T58 register 0x1ffc): Day of week / Century

The day of week register is a free-running counter incremented alongside the day counter. There is no logic for calculating the day of the week, so it must be updated manually when setting the time. Konami games use 1 as Sunday, 2 as Monday and so on.

Bit 4 is a single-bit "counter" that gets toggled each time the year counter overflows. It can be frozen by clearing bit 5. Konami games do not use the century flag, as they interpret any year counter value in 70-99 range as 1970-1999 and all other values as a year after 2000.

0x1f623ffa (M48T58 register 0x1ffd): Day of month / Battery state

Bit 6 is updated when the system is power cycled, if bit 7 has previously been set.

0x1f623ffc (M48T58 register 0x1ffe): Month

0x1f623ffe (M48T58 register 0x1fff): Year

The year counter covers a full century, going from 00 to 99. On each overflow the century flag in the day of week register is toggled.

Other registers

These registers are implemented almost entirely using 74-series logic and the XC9536 CPLD on the main board.

0x1f500000: Bank switch / Security cartridge

Bit 6 controls whether IO0 on the security cartridge is an input or an output. If set, IO0 will output the same logic level as D0, otherwise the pin will be floating. Bits 0-5 are used to switch the device mapped to the 4 MB 0x1f000000-0x1f3fffff region:

0x1f520000: JVSIRDY clear

This register is a dummy write-only port that clears the JVSIRDY flag when any value is written to it. The flag is set by the JVS MCU whenever a new data word is available for reading from 0x1f40000a.

0x1f560000: IDE reset control

Since the IDE reset pin is active-low, a reset is performed by writing 0 to this register, then waiting a few milliseconds and writing 1 again. Note that the IDE specification also defines a way to "soft-reset" devices (e.g. to abort execution of a command) using the SRST bit in the device control register.

0x1f5c0000: Watchdog clear

This register is a dummy write-only port that clears the watchdog timer embedded in the Konami 058232 power-on reset and coin counter driver chip when any value is written to it. The BIOS and games write to this port roughly once per frame.

If the watchdog is not cleared at least every 350-400 ms, it will pull the system's reset line low for about 50 ms in order to force a reboot. The watchdog can be disabled without affecting power-on reset by placing a jumper on S86 (see the pinouts section).

0x1f600000: External outputs

The lower 8 bits written to this register are latched on pins OUT0-OUT7 of the external output connector (see the pinouts section). This connector is used by some games to control cabinet lights without using an I/O board.

0x1f680000: Data to JVS MCU

In order to prevent overruns, this register shall only be accessed when JVSDRDY is cleared. Writing to it will set JVSDRDY.

0x1f6a0000: Security cartridge outputs

The lower 8 bits written to this register are latched on pins D0-D7 of the cartridge slot. See the security cartridge section for an explanation of what each pin is wired to. Bit 0 additionally controls the IO0 pin when configured as an output through the bank switch register. Writing to this register will set the DRDY flag, which can then be cleared by the cartridge.

JVS interface

The System 573 is equipped with a JVS host interface, allowing for connection of I/O modules, controllers and other devices that implement the JVS protocol commonly used in arcade cabinets.

JVS uses a single RS-485 bus running at 115200 bits per second, shared by all devices. The standard JVS connector is a single USB-A port, with the data lines used as the RS-485 differential pair and the VBUS pin as a sensing line (see the JVS specification for details). JVS devices typically have a full size USB-B port for connection to the host, plus optionally another USB-A port for daisy chaining additional devices. The RS-485 bus needs to be terminated; some boards will automatically insert a termination resistor when connected as the last node in a daisy chain.

Packet format

A JVS packet can be up to 258 bytes long and is made up of the following fields:

NOTE: when a JVS packet is sent over the RS-485 bus, any 0xd0 or 0xe0 byte other than the synchronization byte must be escaped as 0xd0 0xcf or 0xd0 0xdf respectively, in order to allow downstream devices to reliably determine the end of a packet. On the 573, the JVS MCU handles escaping outbound packets and unescaping inbound packets automatically. The escaping process does not update the length field to reflect the escaped length of the packet.

Refer to the JVS specification for details on the contents of standard and vendor-specific payloads.

MCU communication protocol

The system's JVS interface is managed by a dedicated H8/3644 microcontroller, interfaced through two 16-bit latches and handshaking lines (in a similar way to the 8-bit ports on the security cartridge slot). The MCU's firmware is stored in OTP ROM and consists of a simple loop that buffers the data written by the 573, sends it, waits for a response to be received and lets the 573 read it.

In order to perform a JVS transaction the 573 must:

1. Reset the MCU through register 0x1f400000, clear JVSIRDY by writing to 0x1f520000 then wait for the status and error codes in register 0x1f400004 to be set to 0 and 3 respectively.
2. Write the packet two bytes at a time to 0x1f680000, waiting for JVSDRDY to go low before each write. Words are little endian, so for instance the first word of a packet with destination address 0x01 would be 0x01e0. If the total length of the packet is odd, the last byte shall still be written as a word (with the upper byte zeroed out).
3. Wait for the status code to become 1. At this point the MCU will send the packet and wait for a response from a device on the bus.
4. Wait for the status code to become 0, signalling a valid response has been received and can be read out. A timeout should be implemented here, as the MCU will wait for a response indefinitely even if no device is present.
5. Read the packet, again two bytes at a time, from 0x1f40000a, waiting for JVSIRDY to go high before each read and clearing it by writing to 0x1f520000 after each read. The status code will be set to 2 after the first word is read and back to 0 once no more data is available to read.

The MCU does not allow for non-JVS packets to be sent as it validates the sync byte, checksum and uses the length field to determine packet length. Responses cannot be received without sending a packet first either. The MCU will also insert a 200 µs minimum delay between the last byte of a received packet and the first byte of the next packet.

I/O boards

The System 573 was designed to be expanded with game-specific hardware using I/O expansion boards mounted on top of the main board, and/or custom security cartridges. I/O boards have access to the 16-bit system bus and are accessible through the 0x1f640000-0x1f6400ff region.

• Analog I/O board (GX700-PWB(F))
• Digital I/O board (GX894-PWB(B)A)
• Alternate analog I/O board (GX700-PWB(K))
• Fishing controller I/O board (GE765-PWB(B)A)
• DDR Karaoke Mix I/O board (GX921-PWB(B))
• GunMania I/O board (PWB0000073070)
• Hypothetical debugging board

Analog I/O board (GX700-PWB(F))

Used in early Bemani games such as DDR 1stMIX and 2ndMIX, as well as some non-Bemani games. The name is misleading as the board does not deal with any analog signals whatsoever; the name was given retroactively to distinguish it from the digital I/O board. It provides up to 28 optoisolated open-drain outputs typically used to control cabinet lights, split across 4 banks:

• Bank A (CN33): 8 outputs (A0-A7)
• Bank B (CN34): 8 outputs (B0-B7)
• Bank C (CN35): 8 outputs (C0-C7)
• Bank D (CN36): 4 outputs (D0-D3)

Some games shipped with partially populated analog I/O boards, thus not all banks may be available. See the game-specific information section for details on how lights are wired up on each cabinet type.

0x1f640080: Bank A

0x1f640088: Bank B

0x1f640090: Bank C

0x1f640098: Bank D

Digital I/O board (GX894-PWB(B)A)

Used by later Bemani games, such as DDR from Solo onwards. This board features the same 28 isolated open-drain outputs as the analog I/O board, plus a Xilinx XCS40XL Spartan-XL FPGA and a Micronas MAS3507D audio decoder ASIC used to play encrypted MP3 files. The FPGA has 24 MB of dedicated DRAM into which the files are preloaded on startup, then decrypted on the fly and fed to the decoder. The board also features 128 KB of SRAM used as a cache, RS-232 and ARCnet transceivers for communication with other hardware and a DS2401 serial number chip, used to prevent usage of the same security cartridge on more than one 573.

The vast majority of the registers provided by this board (including some but not all light outputs) are handled by its FPGA, which requires a configuration bitstream to be uploaded to it in order to work. Registers in the 0x1f6400f0-0x1f6400ff region are handled by a CPLD and are functional even if no bitstream is loaded. There are several known versions of Konami's bitstream:

The DDR and Mambo bitstreams all implement the same registers (listed below) and seem to only differ in the MP3 decryption algorithm, while the unused Martial Beat bitstreams seem to behave in a completely different way.

Homebrew software may also load custom bitstreams developed using the Xilinx ISE 4.2 toolchain (the last version to support Spartan-XL parts). The following custom bitstreams are known to exist so far:

0x1f640080 (FPGA, all bitstreams): Magic number

This register is checked by some versions of Konami's digital I/O board driver to make sure the bitstream was properly loaded.

0x1f640082 (FPGA, 573in1 bitstream): Configuration

Custom register only implemented by the 573in1 bitstream, in order to allow for emulation of quirks present in different versions of Konami's bitstreams as well as control some additional features.

Bits 9-11 tune the behavior of the DAC sample counter registers (0x1f6400ca, 0x1f6400cc and 0x1f6400cf). Setting all of them will make the registers replicate the behavior of those provided by the DDR 3rdMIX bitstream onwards, while clearing them will bring them closer to the earlier DDR Solo Bass Mix bitstream's behavior.

Bits 12, 13 and 15 control the MP3 decryption algorithm. All of them shall be set to decrypt MP3 files from DDR 3rdMIX onwards (scrambled with key1, key2 and key3) or cleared to play DDR Solo Bass Mix files (scrambled with key1 only). Bit 14 controls which byte of each 16-bit word in DRAM is fed to the MAS3507D first and should be cleared for encrypted MP3 playback.

The 573in1 bitstream's descrambler can be configured to play unencrypted data by performing the following steps:

• clear bits 12, 13 and 15;
• set bit 14 (encrypted MP3s are byte swapped as part of the scrambling process but an unencrypted file will have to be swapped during playback);
• clear key1 by writing zero to register 0x1f6400a8, which will render the decryption step a no-op.

0x1f640090 (FPGA, all bitstreams): Network board address

0x1f640092 (FPGA, all bitstreams): Unknown (network related)

0x1f6400a0 (FPGA, all bitstreams): MP3 data start address high

0x1f6400a2 (FPGA, all bitstreams): MP3 data start address low

0x1f6400a4 (FPGA, all bitstreams): MP3 data end address high

0x1f6400a6 (FPGA, all bitstreams): MP3 data end address low

0x1f6400a8 (FPGA, all bitstreams): MP3 frame counter / Descrambler key 1

When read:

When written:

The frame counter is only active when bit 15 in register 0x1f6400ae is set. Note that the MAS3507D also has an internal frame counter readable through I2C, independent of this register.

0x1f6400aa (FPGA, all bitstreams): MP3 playback status

When read:

When written:

During normal operation the reset input should be high and the PIO chip select low. Setting the chip select high will result in the MAS3507D tristating PI19, PI8 and PI4.

0x1f6400ac (FPGA, all bitstreams): MAS3507D I2C

Due to the MAS3507D relying heavily on I2C clock stretching (pulling SCL low to request the host to wait), both SDA and SCL are bidirectional open-drain signals.

0x1f6400ae (FPGA, all bitstreams): MP3 data feeder control

Data is only fed to the MAS3507D when both bits 13 and 14 are set. Bit 12 is a read-only copy of bit 14 and remains set if playback is stopped by clearing bit 13 only.

Bit 15 controls whether to increment register 0x1f6400a8 each time a rising edge is detected on the MAS3507D's PI4 (frame sync) pin. The counter is automatically reset to zero when this bit is cleared.

0x1f6400b0 (FPGA, all bitstreams): DRAM write address high

0x1f6400b2 (FPGA, all bitstreams): DRAM write address low

0x1f6400b4 (FPGA, all bitstreams): DRAM data

NOTE: on some bitstream versions, all registers in the 0x1f6400b0-0x1f6400bf region seem to mirror this register when read (possibly due to incomplete address decoding), however only a read from 0x1f6400b4 will increment the current read pointer and kick off prefetching of the next word.

0x1f6400b6 (FPGA, all bitstreams): DRAM read address high

0x1f6400b8 (FPGA, all bitstreams): DRAM read address low

0x1f6400ba (FPGA, all bitstreams): Unknown

0x1f6400c0 (FPGA, all bitstreams): Network data

0x1f6400c2 (FPGA, all bitstreams): Network TX FIFO length

0x1f6400c4 (FPGA, all bitstreams): Network RX FIFO length

0x1f6400c6 (FPGA, all bitstreams): Unknown

Seems to return 0x7654 on startup.

0x1f6400c8 (FPGA, all bitstreams): Unknown (network related)

Seems to also return 0x7654 on startup.

0x1f6400ca (FPGA, all bitstreams except Solo): DAC sample counter high

0x1f6400cc (FPGA, all bitstreams): DAC sample counter low

0x1f6400ce (FPGA, all bitstreams): DAC sample counter delta

0x1f6400e0 (FPGA, all bitstreams): Bank A

0x1f6400e2 (FPGA, all bitstreams): Bank A

0x1f6400e4 (FPGA, all bitstreams): Bank B

0x1f6400e6 (FPGA, all bitstreams): Bank D

0x1f6400e8 (FPGA, all bitstreams): Internal logic reset

Konami's code writes 0xf000, followed by 0x0000, a delay and 0xf000 again, to this register after uploading the bitstream.

0x1f6400ea (FPGA, all bitstreams): Descrambler key 2

0x1f6400ec (FPGA, all bitstreams): Descrambler key 3

0x1f6400ee (FPGA, all bitstreams): 1-wire bus

When read:

When written:

In addition to the DS2401 the board has an unpopulated footprint for a DS2433 1-wire EEPROM, connected to a separate FPGA pin.

0x1f6400f0 (CPLD): Unknown (unused?)

Konami's code does not write to this CPLD register.

0x1f6400f2 (CPLD): Unknown (unused?)

Konami's code does not write to this CPLD register.

0x1f6400f4 (CPLD): DAC reset

Konami's code uses this register to mute the DAC during FPGA and MAS3507D initialization.

0x1f6400f6 (CPLD): FPGA status and control

When read:

NOTE: all registers in the 0x1f6400f0-0x1f6400ff region seem to return the same value as this register when read, possibly due to incomplete address decoding in the CPLD. Konami's driver only ever reads from this register and treats all other CPLD registers as write-only.

When written:

This register is only written to 3 times when resetting the FPGA prior to loading the bitstream. The values written are 0x8000 first, then 0xc000 and finally 0xf000.

0x1f6400f8 (CPLD): FPGA bitstream upload

Bits written to this register are sent to the FPGA's configuration interface (DIN and CCLK pins, see the XCS40XL datasheet). There is no separate bit to control the CCLK pin as clocking is handled automatically. The FPGA is wired to boot in "slave serial" mode and wait for a bitstream to be loaded by the 573 through this port.

All known games load the bitstream from an array embedded in the executable or a file on the internal flash (usually named data/fpga/fpga_mp3.bin), then write its contents to this port LSB first and monitor the FPGA status register. The bitstream is always 330696 bits (41337 bytes) long as per the XCS40XL datasheet.

0x1f6400fa (CPLD): Bank C

0x1f6400fc (CPLD): Bank C

0x1f6400fe (CPLD): Bank B

Alternate analog I/O board (GX700-PWB(K))

Used by Kick & Kick. Has several optocouplers, plus a DS2401 serial number chip and several unpopulated footprints.

This board is currently undocumented.

Fishing controller I/O board (GE765-PWB(B)A)

Used by the Fisherman's Bait series. Uses an NEC uPD4701 mouse/trackball chip to track motion of the fishing reel's rotary encoders and contains PWM drivers for the feedback motors. Along with the analog I/O board, it is the only known board that does not have a DS2401.

This board is currently undocumented.

DDR Karaoke Mix I/O board (GX921-PWB(B))

Used by DDR Karaoke Mix 1 and 2. Similarly to the digital I/O board, this board features several optoisolated light outputs, an ARCnet PHY and a DS2401 serial number chip. It also has composite video inputs and outputs, a video encoder to convert the 573's native RGB output to composite and additional circuitry to superimpose it onto the video feed from an external karaoke machine. An onboard PC16552 UART is provided to communicate with the machine (the security cartridge also exposes SIO1).

This board is currently undocumented.

GunMania I/O board (PWB0000073070)

Used by GunMania and GunMania Zone Plus. Contains an RGB to S-video converter which drives the cabinet's projector, several motor drivers, optoisolators, a PC16552 UART and a DS2401 serial number chip. A DB25 connector on the side of the board is used to interface to the resistive matrix used to detect bullet shots.

This board is currently undocumented.

Hypothetical debugging board

There is no proof whatsoever of this board having ever existed, but the BIOS and some games attempt to access the hardware on it. It seems to contain at least a Fujitsu MB89371 UART and a 7-segment display, although these may have actually been on two separate boards (or built into a prototype board used by Konami during development).

The MB89371 does not have a publicly available datasheet.

0x1f640000: UART data

0x1f640002: UART control

0x1f640004: UART baud rate select

0x1f640006: UART mode

0x1f640010: 7-segment display

Used by the BIOS kernel while booting (in a similar way to the standard PS1 kernel, which uses register 0x1f802041 instead) as well as the shell and some games. This may have been meant to be a POST display integrated into the 573 main board at some point.